Thread: Unpacking DLLs
View Single Post
  #3  
Old 03-06-2005, 22:06
upb's Avatar
upb upb is offline
Friend
 
Join Date: Apr 2002
Location: Elbonia
Posts: 63
Rept. Given: 5
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 3
Thanks Rcvd at 0 Times in 0 Posts
upb Reputation: 0
open the dll in a hex editor,
remember the byte at entry point and patch it to 0xCC,
make sure your softice/ollydbg/whatever is configured to break on int3,
start the program in the debugger,
wait for int3 break in dll,
patch back the byte you remembered,
set eip back to the entry point to execute this original code (with byte patched pack),
now do whatever is needed to unpack it, trace etc
Reply With Quote